Sign inGet started
Documentation
DocsAPI reference
View as Markdown

Permissions

Every permission a role can carry, grouped by area, with who can hold it and the endpoints that require it.

Updated Sep 22, 2026

Organization

PermissionDescriptionHeld byUsed by
organization.deleteDangerousSchedule the organization for deletionPeople, api_keyNo published endpoint
organization.readRead organization settings and policyPeople, api_key, organization_api_keyNo published endpoint
organization.settings.writeChange organization settings and policyPeople, api_keyNo published endpoint

Membership

PermissionDescriptionHeld byUsed by
membership.inviteInvite people and manage pending invitationsPeople, api_key
GET/api/v1/invitationsPOST/api/v1/invitationsPOST/api/v1/invitations/{id}/resendDELETE/api/v1/invitations/{id}
membership.readList members and pending invitationsPeople, api_key, organization_api_key
GET/api/v1/members
membership.writeSuspend, reactivate, and remove membersPeople, api_key
PATCH/api/v1/members/{id}DELETE/api/v1/members/{id}

Team

PermissionDescriptionHeld byUsed by
team.escalation.activateActivate, roll back, and deactivate team escalation policiesPeople, api_key, organization_api_key
POST/api/v1/teams/{id}/escalation-policy/revisions/{revision}/activateDELETE/api/v1/teams/{id}/escalation-policy/active
team.escalation.writeCreate team escalation policy revisionsPeople, api_key, organization_api_key
POST/api/v1/teams/{id}/escalation-policy/revisions
team.member.writeChange who is on a teamPeople, api_key
PUT/api/v1/teams/{id}/members
team.readList teams and their rostersPeople, api_key, organization_api_key
GET/api/v1/teamsGET/api/v1/teams/{id}GET/api/v1/teams/{id}/escalation-policyGET/api/v1/teams/{id}/escalation-policy/revisionsGET/api/v1/teams/{id}/escalation-policy/revisions/{revision}
team.writeCreate, rename, and archive teamsPeople, api_key
POST/api/v1/teamsPATCH/api/v1/teams/{id}DELETE/api/v1/teams/{id}

Agent

PermissionDescriptionHeld byUsed by
agent.credential.issueDangerousIssue instance credentials and provisioner tokensPeople, api_key, organization_api_key
POST/api/v1/agents/{slug}/instancesPOST/api/v1/agents/{slug}/provisioners
agent.credential.revokeRevoke instance credentials and provisioner tokensPeople, api_key, organization_api_key
DELETE/api/v1/agent-provisioners/{id}DELETE/api/v1/agent-credentials/{id}
agent.readView agents, their instances, and credential statePeople, api_key, organization_api_key
GET/api/v1/agentsGET/api/v1/agents/{slug}GET/api/v1/tool_catalogGET/api/v1/tool_catalog/{id}
agent.writeCreate agents and change their statusPeople, api_key, organization_api_key
POST/api/v1/agentsPATCH/api/v1/agents/{slug}DELETE/api/v1/agents/{slug}POST/api/v1/agents/{slug}/restorePATCH/api/v1/agent_instances/{id}

Pipeline

PermissionDescriptionHeld byUsed by
pipeline.activateActivate and roll back pipeline revisionsPeople, api_key, organization_api_key
POST/api/v1/request-approval-pipelines/organization/revisions/{revision}/activatePOST/api/v1/request-approval-pipelines/agents/{agent_slug}/revisions/{revision}/activate
pipeline.readRead request approval pipelines and their revisionsPeople, api_key, organization_api_key
GET/api/v1/request-approval-pipelinesGET/api/v1/request-approval-pipelines/organizationGET/api/v1/request-approval-pipelines/organization/revisionsGET/api/v1/request-approval-pipelines/organization/revisions/{revision}GET/api/v1/request-approval-pipelines/agents/{agent_slug}GET/api/v1/request-approval-pipelines/agents/{agent_slug}/revisionsGET/api/v1/request-approval-pipelines/agents/{agent_slug}/revisions/{revision}
pipeline.writeCreate and preview request approval pipeline revisionsPeople, api_key, organization_api_key
POST/api/v1/request-approval-pipelines/organization/previewPOST/api/v1/request-approval-pipelines/organization/revisionsPOST/api/v1/request-approval-pipelines/agents/{agent_slug}/previewPOST/api/v1/request-approval-pipelines/agents/{agent_slug}/revisions

Escalation path

PermissionDescriptionHeld byUsed by
escalation_path.activateActivate, roll back, and archive escalation pathsPeople, api_key, organization_api_key
DELETE/api/v1/escalation-paths/{path_key}POST/api/v1/escalation-paths/{path_key}/revisions/{revision}/activate
escalation_path.readRead escalation paths and their revisionsPeople, api_key, organization_api_key
GET/api/v1/escalation-pathsGET/api/v1/escalation-paths/{path_key}GET/api/v1/escalation-paths/{path_key}/revisionsGET/api/v1/escalation-paths/{path_key}/revisions/{revision}
escalation_path.writeCreate escalation paths and their revisionsPeople, api_key, organization_api_key
POST/api/v1/escalation-pathsPOST/api/v1/escalation-paths/{path_key}/revisions

Request

PermissionDescriptionHeld byUsed by
request.claimClaim a pending request while reviewing itPeople, api_key
POST/api/v1/requests/{id}/claimDELETE/api/v1/requests/{id}/claim
request.createCreate approval requestsAgents
POST/api/aap/v1/requestsDELETE/api/aap/v1/requests/{id}
request.decideApprove or deny requests routed to youPeople, api_key
POST/api/v1/requests/{id}/decisionGET/api/v1/requests/{id}/reviewer-candidatesPOST/api/v1/requests/{id}/reviewers
request.decide.unroutedDangerousDecide requests that were routed to other people (break glass)People, api_keyNo published endpoint
request.readRead approval requests and their outcomesPeople, api_key, organization_api_key, Agents
GET/api/aap/v1/requests/{id}GET/api/v1/requestsGET/api/v1/requests/{id}GET/api/v1/requests/{id}/routingGET/api/v1/requests/{id}/timeline
request.read.unroutedRead requests that were routed to other people, whatever the visibility policyPeople, api_key, organization_api_keyNo published endpoint

Gateway

PermissionDescriptionHeld byUsed by
gateway.callHosted editionRelay tool calls through the MCP gatewayGatewayNo published endpoint
gateway.readHosted editionView MCP gateway servers and credentialsPeople, api_key, organization_api_key
GET/api/v1/agents/{slug}/tool-access
gateway.writeHosted editionConfigure MCP gateway servers and credentialsPeople, api_key, organization_api_key
PUT/api/v1/agents/{slug}/tool-access/{server_slug}

Webhook

PermissionDescriptionHeld byUsed by
webhook.readView webhook endpointsPeople, api_key, organization_api_key
GET/api/v1/webhook_endpointsGET/api/v1/webhook_endpoints/{endpoint_key}GET/api/v1/webhook_endpoints/{endpoint_key}/revisionsGET/api/v1/webhook_endpoints/{endpoint_key}/revisions/{revision}GET/api/v1/webhook_endpoints/{endpoint_key}/uses
webhook.writeCreate, edit, rotate, and delete webhook endpointsPeople, api_key, organization_api_key
POST/api/v1/webhook_endpoints/{endpoint_key}/revisionsPOST/api/v1/webhook_endpoints/{endpoint_key}/revisions/{revision}/activatePOST/api/v1/webhook_endpoints/{endpoint_key}/revisions/{revision}/testDELETE/api/v1/webhook_endpoints/{endpoint_key}/activePOST/api/v1/webhook_endpoints/{endpoint_key}/rotate_secret

Connection

PermissionDescriptionHeld byUsed by
connection.readView SSO, directory, chat, and domain connectionsPeople, api_keyNo published endpoint
connection.writeDangerousConnect and disconnect SSO, directories, chat apps, and domainsPeople, api_keyNo published endpoint

Audit

PermissionDescriptionHeld byUsed by
audit.readHosted editionRead the audit logPeople, api_key, organization_api_key
GET/api/v1/auditGET/api/v1/audit/{id}GET/api/v1/audit/event_types

Api key

PermissionDescriptionHeld byUsed by
api_key.issueMint personal API keys and manage your ownPeople
POST/api/v1/oauth_authorizationsPOST/api/v1/me/api_keys
api_key.readList every API key in the organizationPeople
GET/api/v1/api_keysGET/api/v1/api_keys/{id}
api_key.revokeRevoke any API key in the organizationPeople
DELETE/api/v1/api_keys/{id}
api_key.organization.issueDangerousHosted editionIssue organization API keysPeople
POST/api/v1/api_keysGET/api/v1/api_keys/options

Permission policy

PermissionDescriptionHeld byUsed by
permission_policy.readRead permission policies and available permissionsPeople, api_keyNo published endpoint
permission_policy.writeDangerousGrant and revoke permission policies for people and teamsPeople, api_key
POST/api/v1/members/{id}/permission_policiesPUT/api/v1/members/{id}/permission_policies/{policy_id}DELETE/api/v1/members/{id}/permission_policies/{policy_id}POST/api/v1/teams/{id}/permission_policiesPUT/api/v1/teams/{id}/permission_policies/{policy_id}DELETE/api/v1/teams/{id}/permission_policies/{policy_id}POST/api/v1/api_keys/{id}/permission_policiesPUT/api/v1/api_keys/{id}/permission_policies/{policy_id}DELETE/api/v1/api_keys/{id}/permission_policies/{policy_id}